Jump to content

Hijack.AutoConfigURL.PrxySvrRST, Backdoor.Farfli In Registre Key


Go to solution Solved by Maurice Naggar,

Recommended Posts

Hi may I ask how I can fix this permanently? Thank you very much in advance.

I ran Malwarebytes and these are what it found:

HELP, PLEASE, THANKS

Clave del registro: 3
Backdoor.Farfli, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\AppServicef, En cuarentena, 5086, 954956, 1.0.59805, , ame, , , 
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, En cuarentena, 3611, -1, 0.0.0, , action, , , 
Backdoor.Farfli, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\AppServicef\PARAMETERS, En cuarentena, 5086, 954916, 1.0.59805, , ame, , , 

Valor del registro: 6
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-705702485-3285949748-512925929-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, En cuarentena, 3611, 1078095, 1.0.59805, , ame, , , 
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-705702485-3285949748-512925929-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, En cuarentena, 3611, -1, 0.0.0, , action, , , 
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En cuarentena, 3611, -1, 0.0.0, , action, , , 
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-705702485-3285949748-512925929-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En cuarentena, 3611, -1, 0.0.0, , action, , , 
Hijack.AutoConfigURL.PrxySvrRST, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En cuarentena, 3611, -1, 0.0.0, , action, , , 
Backdoor.Farfli, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\AppServicef\PARAMETERS|SERVICEDLL, En cuarentena, 5086, 954916, 1.0.59805, , ame, , , 

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 0
(No hay elementos maliciosos detectados)

Archivo: 1
Backdoor.Farfli, C:\WINDOWS\SYSTEM32\IUPKG0XL5W.TMP, En cuarentena, 5086, 954956, , , , , 8074F73F7742309B033676CD03EB0928, BE94DF270ACFC8E5470FA161B808D0DE1C9E85EFEEFF4A5D82F5FD09629AFA8E

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

  • Please attach  mbst-grab-results.zip    to your reply
  • The IP block actions by Malwarebytes are keeping the machine safe from potential threats.
  • We do need the support zip reports to see more detail  ( the screen grabs just do not have full details + those screens give no clue as to what processes are running.
Link to post
Share on other sites

Thank you. 

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRSTENGLISH.exe  on the C:\Users\Michael\Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  JUan16378263  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt           <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 

Please attach the FIXLOG.txt with your next reply later, at your next opportunity. We will be doing more later.

Link to post
Share on other sites

As part of the custom-fix-run, Windows System File Checker (SFC) found & corrected some system files. 

Quote

Windows Resource Protection found damaged files and successfully repaired them.

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run. 

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

  • Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.  That is, once it is under way, you should leave it running.  It will run for several hours.

  • At screen "Detections occured and resolved" click on blue button "View detected results"
  • On next screen, at lower left, click on blue "Save scan log"
  • View where file is to be saved. Provide a meaningful name for the "File name:"
  • On last screen, set to Off (left) the option for Periodic scanning
  • Click "save and continue"
  • Please attach the report file so I can review
Link to post
Share on other sites

The ESET Online scanner run is well worth the effort. It found and removed a few javascript trojans in what looks like a Cache area.
Next, a scan with a different antivirus tool. This is a one time run. This Microsoft tool is a on-demand standalone tool.The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  FULL scan  .

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
  • Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
  • We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. We will do more later.

 
Edited by Maurice Naggar
Link to post
Share on other sites

Good evening Mr. Maurice, I just finished the scan, at first it said 26 infected files and in the end it didn't detect anything, here I am attaching the msert.log file, I have the computer turned on since we started the process without doing anything other than the process, I will let the computer rest a bit, tomorrow I will be attentive to the next steps, thanks for your help 😀.

msert.log

Link to post
Share on other sites

The end result of the Microsoft Safety Scanner is all perfectly fine. No virus, No trojan, No infection found by it. 

Quote

Results Summary:
----------------
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Fri Sep  9 21:10:54 2022

By the way, about what you "saw" on intermediate displays of the Microsoft Safety Scanner,  I would like you to review the remarks by AndyDavid about all that on this Microsoft community venue https://docs.microsoft.com/en-us/answers/questions/326108/mar-1721-msert-detects-items-during-scan-but-at-en.html

Also, the post by EricYin of Microsoft  ( just below that section) 

Quote

if nothing reported in %SYSTEMROOT%\debug\msert.log, that means no infections.

It's only the final report that matters.  For the gory details, see  https://answers.microsoft.com/en-us/protect/forum/protect_scanner-protect_scanning-windows_10/what-is-wrong-with-the-microsoft-safety-scanner/27c95df9-7d49-4d02-b734-bcb16495cfc3?messageId=e199de56-9a50-4cc5-a37a-3a7f2708b093

See also https://support.microsoft.com/en-us/topic/how-to-troubleshoot-an-error-when-you-run-the-microsoft-safety-scanner-6cd5faa1-f7b4-afd2-85c7-9bed02860f1c

 

Link to post
Share on other sites

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Next, the Malwarebytes scan.

Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

MB4_scan_tick_ALL.jpg.954dd31097351eba2c305a1321a445d6.jpg

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.99b8d9b73d90d347577ae0826ac406b1.jpg

 


Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4 

Also with your next reply, Let me know, "How is the system at that point ?" 

Link to post
Share on other sites

2 hours ago, Maurice Naggar said:

"How is the system at that point ?" 

Good morning Mr. Maurice, check for updates and there weren't any, I did a first scan and it made 6 detections of Hijack.AutoConfigURL.PrxySvrRST in the registry editor, I quarantined them and restarted the computer.

every time it got to that point after the reboot, it would scan again and they would show up regardless of them being quarantined, so I did a second scan after the reboot and made 10 detections this time, both mentioning Hijack.AutoConfigURL.PrxySvrRST and Backdoor. Farfli

Do I delete the quarantined files?

Here I attach the files of the two scans.

FirstScan.txt SecondScan.txt

Link to post
Share on other sites

2 hours ago, Maurice Naggar said:

"How is the system at that point ?" 

Good morning Mr. Maurice, check for updates and there weren't any, I did a first scan and it made 6 detections of Hijack.AutoConfigURL.PrxySvrRST in the registry editor, I quarantined them and restarted the computer.

every time it got to that point after the reboot, it would scan again and they would show up regardless of them being quarantined, so I did a second scan after the reboot and made 10 detections this time, both mentioning Hijack.AutoConfigURL.PrxySvrRST and Backdoor. Farfli

Do I delete the quarantined files?

Here I attach the files of the two scans.

FirstScan.txt SecondScan.txt

Link to post
Share on other sites

What is in the Malwarebytes' Quarantine section is in permannet jail --let us not fret about that. We leave the Quarantine area alone. Stuff in there cannot do anything. It cannot "jump" out.
Rather, let us use the support tool of Malwarebytes to get a fresh collection report. The tool is at C:\Users\Michael\Downloads\mb-support-1.8.7.918.exe

Launch mb-support-1.8.7.918.exe
Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done: Attach the mbst-grab-results.zip from the Desktop

Edited by Maurice Naggar
Link to post
Share on other sites

Thank you. This is a 2nd custom-fix script, a short one. It is more targeted to cleaning up the issue-at-hand. Hopefully it quashes any remains of the main pest.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRSTENGLISH.exe  on the C:\Users\Michael\Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  JUan16378263  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt           <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start.  Please attach the FIXLOG.txt with your next reply later, at your next opportunity. We will be doing more later.

Link to post
Share on other sites

Thank you. That was a good run. This is a 3rd custom-fix script, a short one. It is more targeted to removing 1 specific exclusion on settings of MS Defender antivirus & also running 2 scans with MS Defender antivirus.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRSTENGLISH.exe  on the C:\Users\Michael\Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  JUan16378263  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt        <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start.  Please attach the FIXLOG.txt with your next reply later, at your next opportunity. We will be doing more later.

Link to post
Share on other sites

4 minutes ago, juan16378263 said:

Listo Maurice ya hice el proceso, durante el proceso Windows Defender detectó un malware aquí adjunto 2 capturas de pantalla, también adjunto el archivo fixlog de la reparación.

sorry for the spanish text, "Ready Maurice I already did the process, during the process Windows Defender detected a malware here I attach 2 screenshots, I also attach the fixlog file of the repair."

Link to post
Share on other sites

Thank you. That was a good run.
Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

This is a 4th custom-fix script, a short one. It is more targeted to re-running 2 scans with MS Defender antivirus.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRSTENGLISH.exe  on the C:\Users\Michael\Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  JUan16378263  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt    <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start.  Please attach the FIXLOG.txt with your next reply later, at your next opportunity. We will be doing more later.

Link to post
Share on other sites

Thank you. We are making some progress. At the same time, there is concern because a setting for MS Defender keeps being put back. What follows are 2 runs that I want you to do. One after the other. That is when you finish the first, proceed to do the second.  

This is a 5th custom-fix script, a short one. It will be re-running 2 scans with MS Defender antivirus.

This will NOT involve a Restart.

We will use FRSTENGLISH.exe  on the C:\Users\Michael\Downloads folder to run a custom script.    

This custom script is for  JUan16378263  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt    <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start.  Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

Part 2

We will run another antivirus scanner  and see if it finds any other issues for us.

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 


Select the  image.png  Windows Key and R Key together, the "Run" box should open.

user posted image

Drag and Drop KVRT.exe into the Run Box.

user posted image

C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box.

image.png

add -dontencrypt   Note the space between KVRT.exe and -dontencrypt

C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.
 
image.png


That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file.

Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr
Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply.

To start the scan select OK in the "Run" box.

A EULA window will open, tick all confirmation boxes then select "Accept"

image.png

In the new window select "Change Parameters"

image.png

In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start...

user posted image

When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue"

user posted image

When complete, or if nothing was found select "Close"

image.png

Attach the report information as previously instructed...
 
Thank you
Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.